插入在 SQL 中返回语法错误 [重复]

Question

PHP

<?php
        $server_name= "localhost";
        $db_user="root";
        $db_password="";
        $db_name="digitalmarketing";

        $connection=mysqli_connect($server_name,$db_user,$db_password,$db_name);
        $dbconfig=mysqli_select_db($connection,$db_name);

        session_start();
        $_SESSION['message']='';

        if($_SERVER['REQUEST_METHOD']=='POST')
        {
            $title= mysqli_real_escape_string($connection,$_POST['title']);
            $Des= mysqli_real_escape_string($connection,$_POST['des']);
            $imagepath= mysqli_real_escape_string($connection,'Projects/'.$_FILES['filename']['name']);
            $link= mysqli_real_escape_string($connection,$_POST['link']);
            echo $title,"           ";
            echo $Des,"           ";
            echo $imagepath,"           ";
            echo $link," \n          ";

            if(preg_match("!image!",$_FILES['filename']['type'])){
                if(copy($_FILES['filename']['tmp_name'],$imagepath)){
                    $query="INSERT INTO `project` (`id`, `Title`, `Description`, `Image`, `Site`) VALUES (NULL, $title, $Des, $imagepath, $link)";
                    if(mysqli_query($connection, $query))
                    {
                        echo "success";
                    }
                    else {
                        echo "Error: " . $query . "<br>" . mysqli_error($connection);
                    }
                }
            }
        }

错误

错误：插入到project（id、Title、Description、Image、Site）值（NULL、TitleHere、DescriptionHere、Projects/Screenshot 2021-03-18 222903.png , https://www.w3schools.com/tags/att_input_type.asp) 您的 SQL 语法有错误；检查与您的 MariaDB 服务器版本相对应的手册，以在第 1 行的“2021-03-18 222903.png,https://www.w3schools.com/tags/att_input_type.asp)”附近使用正确的语法

为什么会出现这个错误？

Answer 1

改变

$query="INSERT INTO `project` (`id`, `Title`, `Description`, `Image`, `Site`) VALUES (NULL, $title, $Des, $imagepath, $link)";

到

$query="INSERT INTO `project` (`id`, `Title`, `Description`, `Image`, `Site`) VALUES (NULL, '$title', '$Des', '$imagepath', '$link')";

额外：阅读有关使用准备好的语句并使用它的信息。 https://www.tutorialrepublic.com/php-tutorial/php-mysql-prepared-statements.php